From: Yingjie Wang scsi_bsg_uring_task_cb() discards the return from blk_rq_unmap_user(). A successful data-in command can therefore post CQE 0 even when bounce data was not delivered to userspace. Use the unmap result as the CQE status. A later sense-buffer copy failure remains -EFAULT as before. A raw BSG INQUIRY into an unaligned anonymous PROT_NONE mapping posted false success in 20/20 runs before this change and -EFAULT in 20/20 runs afterward. Writable controls continued to succeed. Fixes: 7b6d3255e7f8 ("scsi: bsg: add io_uring passthrough handler") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Yingjie Wang --- drivers/scsi/scsi_bsg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/scsi/scsi_bsg.c b/drivers/scsi/scsi_bsg.c index 341142dda71d..f776c4a74fb3 100644 --- a/drivers/scsi/scsi_bsg.c +++ b/drivers/scsi/scsi_bsg.c @@ -54,7 +54,7 @@ static void scsi_bsg_uring_task_cb(struct io_tw_req tw_req, io_tw_token_t tw) blk_mq_free_request(rq); if (pdu->bio) - blk_rq_unmap_user(pdu->bio); + ret = blk_rq_unmap_user(pdu->bio); if (sense_len_wr) { if (copy_to_user(uptr64(pdu->response_addr), sense_buffer, -- 2.43.0